WinDbg script

$$ bpep.wds - Entry point stopper [lhc645,2010] - WinDbg script
.block
{
.catch
{
  $$ part I
  $$ find entry point address (ldr)
  r? $t0 = &@$peb->Ldr->InLoadOrderModuleList
  r? $t1 = *(ntdll!_LDR_DATA_TABLE_ENTRY**)@$t0
  r $t2 = @@c++(@$t1->EntryPoint)
  .printf "Main module entry point 0x%I64X\n", @$t2
  $$ set breakpoint on ep
  bp @$t2
  $$ part II
  $$ set breakpoint on tls callbacks
  r $t1 = @@c++(@$t1->DllBase)
  .printf "Main module base 0x%I64X\n", @$t1
  r? $t2 = (ntdll!_IMAGE_NT_HEADERS64*)(*(unsigned long *)(@$t1+0x3c)+@$t1)
  .printf "PIMAGE_NT_HEADERS64: 0x%I64X\n", @$t2
  r $t0 = @@c++(@$t2->OptionalHeader.DataDirectory[9].VirtualAddress)
  .if (@$t0!=0)
  {
   r $t0 = @$t0 + @$t1
   .printf "PIMAGE_TLS_DIRECTORY64: 0x%I64X\n", @$t0
   $$ addressofcallbacks
   r? $t0 = *(void**)(@$t0+0x18)
   .printf "Address of callbacks %I64X\n",@$t0
   r? $t2 = *(void**)@$t0
   .while(@$t2!=0)
   {
     .printf "Callback %I64X\n",@$t2
     bp @$t2
         r $t0 = $t0+8
         r? $t2 = *(void**)@$t0
   }
  }
  .else
  {
    .printf "Tls directory is not found!\n"
  }
  $$ Go!
  g
 }
}